ANS-C01 Network Security, Compliance and Governance Practice Question
A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC. The security team wants to block a list of known malicious IP addresses from accessing the application. Which service should they use to implement this protection?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS WAF with an IP set rule that blocks the malicious IPs
AWS WAF is a web application firewall that can inspect HTTP/S traffic and block requests based on conditions such as IP addresses. By creating an IP set containing the malicious IPs and associating it with a web ACL on the ALB, the security team can block those IPs at the application layer. This is more granular and efficient than network-level controls. Option A (Network ACLs) are stateless and operate at the subnet level, not designed for application-layer filtering, and would require managing deny rules that conflict with the default allow. Option C (AWS Shield Advanced) provides DDoS protection and cost protection, but does not offer granular IP blocking based on a custom list. Option D (Security Groups) are stateful firewalls that only support allow rules; they cannot deny specific IP addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network ACLs on the ALB subnet with deny rules
Why it's wrong here
Network ACLs are stateless and affect all traffic, not targeted.
- ✓
AWS WAF with an IP set rule that blocks the malicious IPs
Why this is correct
WAF integrates with ALB and can block IPs.
- ✗
AWS Shield Advanced with automatic IP blocking
Why it's wrong here
Shield Advanced is for DDoS mitigation, not custom IP blocking.
- ✗
Security Groups for the ALB with deny rules
Why it's wrong here
Security groups support allow rules only, not deny.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS WAF to protect a web application behind an Application Load Balancer. The security team notices that a specific IP address is generating a high number of requests and wants to block it immediately. What is the MOST efficient way to block this IP address?
medium- ✓ A.Add the IP address to an IP set in AWS WAF and update the rule to block it
- B.Add a deny rule in the security group attached to the ALB
- C.Update the Network ACL associated with the ALB subnets to deny inbound traffic from the IP address
- D.Create a new web ACL in AWS WAF and associate it with the ALB
Why A: AWS WAF allows adding an IP address to an existing IP set and updating the associated rule to block it, which takes effect quickly and is the most efficient method. Option B is wrong because security groups are stateful and cannot explicitly deny inbound traffic; they only allow rules. Option C is wrong because Network ACLs operate at the subnet level and require updating both inbound and outbound rules, which is slower and less granular than WAF IP sets. Option D is wrong because creating a new web ACL and associating it takes more steps than updating an existing rule, making it less immediate.
Variation 2. A company is using AWS WAF to protect a web application behind an Application Load Balancer. They want to block requests from a specific IP address range. Which component should they use?
easy- A.Security group associated with the ALB
- ✓ B.IP set match condition in AWS WAF
- C.AWS Shield Advanced
- D.Network ACL on the ALB's subnets
Why B: AWS WAF includes IP set match conditions that allow you to specify IP addresses to block or allow, which directly addresses the requirement to block requests from a specific IP address range. Option A is wrong because security groups are stateful firewalls for EC2 instances and cannot be directly associated with an ALB to filter web requests. Option C is wrong because AWS Shield Advanced provides DDoS protection but does not offer granular IP-based blocking. Option D is wrong because network ACLs operate at the subnet level and are not integrated with ALB for web request filtering.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.